There are ways to protect yourself, however. When it comes to IT, the need for redundancy is obvious. The cost of an information technology outage to a major corporation from floods, terrorism or whatever, is huge. It can put the company out of business. But the cost of backup and redundancy in IT is relatively low, especially when you compare it to having a redundant manufacturing plant.

Is there a difference between redundancy and mere backup?

Redundancy is more than the backup of data. Redundancy may require, for example, the ability to get more hardware in the event of a disaster. You need an agreement with Dell or HP or anyone else to get the equipment and make sure that you have the capacity, power and other infrastructure to handle the data. For example, during 9/11, Merrill Lynch not only had backup of all its data and transactions, it had shadow trading floors already set up in New Jersey. When the exchange reopened, Merrill Lynch was trading. They were up and running even though they were in the South Tower when the airplane hit. We need redundancy in all the supporting infrastructure, not just the backup of the actual data.

It’s interesting to look at Cantor Fitzgerald as well. They were the largest bond trader in the world, and they lost 657 employees on 9/11. A lot of people thought they’d never survive because it’s a very relationship-based business. But from the IT perspective they were able to recover because all their data was backed up. Even with their infrastructure gone, they had Microsoft come in and recover their lost passwords and get their operating system back on line. A competitor let Cantor Fitzgerald use its systems while Texas Instruments rebuilt their infrastructure. They were able to recover because they had been backing up their data in real-time.

It’s clear that IT-intensive companies like Cantor Fitzgerald and Merrill Lynch need a lot of redundancy and backup. But for other companies, it may not be as clear. How does a company decide how much redundancy it needs for its IT systems?

Any large company will need a minimum, such as daily backup. But then the question becomes, what happens if they lose one day’s worth of transactions? For some companies it won’t matter. It’s not a company question though, it’s a nature of the data question. At a university, for example, there are few items that need continuous backup. When they are doing financial transactions with a vendor, buying and selling supplies and equipment, they might need that backup. But other data, such as student information and research material, doesn’t change that often; so if you do it nightly, it may be fine.